Skip to content

Guide

Setting Up a Transfer Agent, Registrar or Paying-Agent Business in the UAE

Published

The short answer

Who decides depends on what the UAE company controls, not what it calls itself. A business that maintains the authoritative register of holders, processes transfers, or calculates and pays out entitlements sits inside a financial regulator's perimeter: the Dubai Financial Services Authority (DFSA) in the DIFC, the Financial Services Regulatory Authority (FSRA) in ADGM, the Capital Market Authority (CMA, the successor body to the former Securities and Commodities Authority) for onshore securities, or the Central Bank of the UAE (CBUAE) wherever it directs payments. A plain commercial licence only fits a technology provider that never touches the register or the money. The fact that decides the route most is whether the company, not a principal it serves, holds authority over the register and the cash.

Who the regulator is, and what actually sets the perimeter

Four business models carry the same pitch-deck language and are not the same thing in law. A registrar holding the authoritative record of who owns what sits closest to the regulator, because changing that record changes a legal entitlement. A transfer agent carries the same weight whenever it can instruct a change without a second signature, and a paying agent moves money as well as data, bringing a payments regulator into the picture too. A technology provider supplying recordkeeping software to a principal who does all of the above is the one model that can sit on an ordinary commercial licence, provided the contract and the workflow genuinely match that description.

The perimeter also follows geography: the DFSA for firms authorised in the DIFC, the FSRA in ADGM, the CMA for securities-related activity onshore, and the CBUAE wherever payment flows are directed. A firm serving issuers or investors across more than one has to be classified in each, as does a fund administrator or an investment-research or financial-publishing company. Where the register is built for a tokenised instrument, the perimeter sits with VARA instead, covered under VARA and virtual-asset setup, and a technology-only build belongs under fintech setup.

What the regulators actually decide

Each regulator's own page sets the current authorisation categories and application route, and these change, so get written confirmation first.

  • The DFSA decides whether a DIFC firm needs authorisation for registrar, transfer-agency or paying-agent activity, and which individuals must be personally approved.
  • The FSRA makes the equivalent decision for ADGM firms.
  • The CMA decides the position for a registrar or transfer agent serving onshore securities.
  • The CBUAE publishes the Rulebook that applies to the institutions it supervises, which a correspondent bank reads when assessing a paying agent's payment flows.

None of these pages publish a universal capital figure or processing timeline for this sector as read on the date checked, so none is stated here. The question should be revisited whenever the company adds a new instrument type or market.

How the money moves, and what a bank checks

The three operating models carry different money risk. A pure registrar usually never touches cash; it holds records only. A transfer agent can be asked to handle subscription monies moving in and out of a fund. A paying agent is the heaviest model: it calculates entitlements and moves money to holders on a schedule the issuer does not control.

A bank reviewing any of these asks who may approve a payment instruction, whether client or issuer money sits apart from the company's own operating account, and how a reconciliation break between the issuer's instruction, the register and the bank statement is caught before it reaches a holder. Readiness work for a corporate bank account should build this evidence before the first banking conversation, not after a rejection.

Ownership, control functions and the roles that must be filled

A registrar, transfer agent or paying agent is judged on its people as much as its entity. Three roles recur: someone accountable for the register's accuracy, someone with authority to approve or block an unusual payment instruction, and someone who owns reconciliation between issuer, bank and holder records.

Where the company is owned through a holding structure, a trust, or investors from more than one jurisdiction, that chain has to be mapped before the regulator or a bank asks: the territory regulated and complex ownership setup covers. Source-of-wealth evidence for the individuals behind it belongs in the same file; source of wealth and funds work is built for that record, and should match the business plans and documentation the regulator and the bank both read.

What commonly goes wrong in this sector

  • Calling an operated register a software-only service, when the contract shows the company approves changes to it.
  • Allowing a payment instruction out on one signature, with no second person able to block it.
  • Letting issuer, bank and holder records drift out of reconciliation until a holder complains.
  • Taking on a new instrument type without reopening the classification that applied to the first one.

The underlying failure is usually the same: the entity, the software and the office are bought first, before anyone confirms who is accountable for the register and the money.

From licence to daily operation

Classification decides more than the first filing. A DFSA- or FSRA-authorised registrar, transfer agent or paying agent typically needs an accountable individual physically present in the DIFC or ADGM, a visa question as much as a regulatory one. Authorisation runs its own renewal rhythm, separate from the commercial licence's, and an approved individual's status is reviewed on the regulator's own calendar. Tax registration with the Federal Tax Authority (FTA) follows once the entity exists.

Cost builds in layers, and the Velarozone service fee is itemised in the engagement letter; how Velarozone works sets out the approach. Where a regulator publishes a capital or personnel requirement for the activity, that figure governs and should be read from the regulator's own page at the time of application.

Container terminal and cranes at a Dubai port

General guidance here; the detail that matters depends on your activity and markets.

Questions

Frequently asked

Does a UAE registrar or transfer agent need DFSA or FSRA authorisation, or can it operate from an ordinary trade licence?
Only a technology-only provider that never controls the register or the money can expect an ordinary commercial licence to fit. Once the company can approve a register change or instruct a payment, the DFSA or FSRA position needs testing before a jurisdiction is chosen, because the activity carries the authorisation requirement, not the entity's trade name.
Can a paying agent hold client or issuer money in its own operating account?
Mixing client or issuer money with the company's own operating funds is the first thing a bank and a regulator both query. That money is generally expected to sit apart, with a documented approval chain for any instruction to move it.
What happens if the register is for a tokenised instrument rather than a conventional security?
The analysis does not change because the instrument is digital, but the regulator does. A register for a tokenised instrument typically runs through VARA rather than the DFSA, the FSRA or the CMA, and the classification should be tested again for that instrument specifically.
Does supplying only the recordkeeping software, without operating the register, change the position?
It can, provided the contract and the workflow genuinely match that description. A system configured so only the principal can approve a change sits differently from one whose own staff perform the approval on the principal's behalf.
Does serving an issuer registered outside the DIFC or ADGM change which regulator applies?
Yes. The regulator follows where the company is authorised and, separately, where the instrument and issuer sit, so a UAE-based registrar serving an onshore issuer is tested against the CMA's position, not the DIFC or ADGM one.

Get your UAE setup plan

For a registrar, transfer agent or paying-agent business, the setup question is which model the company runs, who controls the register and the money, and which regulator reads that answer first. Velarozone maps the classification, the money-movement controls and the banking evidence before anything is filed.

Apply this to your own situation

Guides describe the general position. Send us your facts and an adviser will tell you which parts actually apply to you.

Message us on WhatsApp

Free assessment: current figures are confirmed within your adviser-reviewed route comparison. Your details are not shared with third parties.

Start with a structure assessment

In an initial consultation you receive a plain-language decision summary, a document-preparation list, and the next actions for your situation. Current figures are confirmed within your adviser-reviewed route comparison.

This guide provides general information, not legal, regulatory, tax, investment, medical or financial advice. It does not guarantee a licence, authorisation, visa, bank account, funding, tax treatment or commercial outcome.

General information drawn from the CBUAE Rulebook, including the Retail Payment Services and Card Schemes Regulation (C 15/2021), and Cabinet Resolution No. (134) of 2025 as published, not legal or tax advice. Rules and guidance change, so confirm the current text and each institution's own requirements before you submit.